========================================================================
[REQUEST] GET /victim?via=preview
  trigger:        InitiatePreview (vulnerable path)
  Host:           127.0.0.1:8443
  Sec-Fetch-Site: none
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Dest: document
  Sec-Purpose:    prefetch;prerender;preview
  >>> BUG CONFIRMED: renderer-chosen URL fetched with Sec-Fetch-Site: none (browser-initiated)
========================================================================
[REQUEST] GET /victim?via=open
  trigger:        window.open (control)
  Host:           127.0.0.1:8443
  Sec-Fetch-Site: cross-site
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Dest: document
  Sec-Purpose:    <missing>